And given most companies run managed browsers on managed systems, the user agent is going to collide too

Indeed. This is one of the limitations to our approach. We're thinking of ways to workaround it. Please shout if you have any ideas ;)

Not just inside a company network. CGNAT is pretty commonplace nowadays.